Sleepwalker Windows backdoor hides in memory and waits for encrypted commands

Security researcher Dominik Reichel has detailed a previously undocumented Windows backdoor called Sleepwalker, describing malware designed to remain dormant until it receives a specially formatted network packet. The sample’s capabilities and unusual design suggest a targeted operation, although there is currently no evidence linking it to a particular campaign, victim or threat group.

Sleepwalker is concealed in a 64-bit DLL that impersonates Microsoft’s dpapi.dll, a legitimate component associated with Windows data protection. The malicious file exports the same seven functions as the genuine library and attempts to redirect calls to a nonexistent file named dpapisvc.dll. It also contains a forged ESET Management Agent version resource and is intended to load through DLL side-loading alongside ERAAgent.exe.

After checking that it is running inside the expected process, the malware retreats into memory. Rather than establishing a conventional connection to an attacker-controlled command-and-control server, it passively inspects network traffic for a specific “magic packet.” It does not normally open a listening port or generate outbound traffic, potentially allowing it to evade monitoring based on suspicious connections or known malicious infrastructure.

A custom bytecode system

Commands delivered to Sleepwalker are protected with AES-256-CCM. Once decrypted, they are not readable text but short sequences of bytes interpreted through a custom language containing 23 instructions. The available operations include scheduling tasks, starting concurrent programs, receiving additional instructions, transferring data, and executing code in memory.

Some functions can send information over TCP, write data to Windows named pipes, or communicate with a VMware VMCI target rather than a conventional network address. Other instructions support TCP or UDP listeners, named-pipe connections, staged file construction and program execution. Certain routines can also wait for a file to be assembled and validated before launching it.

Investigation remains limited

Reichel said the available sample does not reveal how operators obtained access, delivered the DLL or used the malware after deployment. There is also no current basis for determining its prevalence, geographic reach or relationship to known groups.

For potential victims, the researcher has released tools intended to decode Sleepwalker’s bytecode, review encrypted and network artifacts, and analyze its receiving mechanism without executing commands or sending traffic. A mitigation guide and remediation script are also available for confirmed detections.